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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
effectiveness, and efficiency within the department. 

This report assesses the effectiveness of the information technology systems being used 
by the DHS Office of Chief Procurement Officer to provide oversight of Hurricane 
Katrina-related procurements. It is based on interviews with employees and officials of 
relevant agencies and institutions, direct observations, and a review of applicable 
documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. It is 
our hope that this report will result in more effective, efficient, and economical 
operations. We express our appreciation to all of those who contributed to the preparation 
of this report. 




Richard L. Skinner 
Inspector General 
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Executive Summary 

We audited the Department of Homeland Security (DHS) Office of 
the Chief Procurement Officer (OCPO) to determine the 
effectiveness of the information technology (IT) systems used to 
oversee Hurricane Katrina-related procurements. We also 
performed a limited review of internal control processes associated 
with information security as well as capital planning and 
investment control requirements. This audit included a review of 
applicable DHS policies, procedures, and other appropriate 
documentation. 

We determined that DHS does not have a comprehensive IT 
system that can provide reliable information on procurements 
related to DHS' response to Hurricane Katrina. DHS is required to 
collect and report procurement data, including data related to 
Hurricane Katrina, to the Federal Procurement Data System - Next 
Generation (FPDS-NG). 1 However, DHS has not completed its 
plans to provide timely and accurate procurement data to 
FPDS-NG. Responding to requests for real-time reporting of 
procurement data, the OCPO implemented a management process 
to capture procurement data related to DHS' response to Hurricane 
Katrina. This management process resulted in a series of electronic 
spreadsheets that the OCPO provided as weekly reports, titled 
Katrina USG Direct Presidential Report. However, we 
determined that the OCPO could not assure the validity of the data 
in these spreadsheets. Therefore, DHS management and the public 
could not depend on the information in these spreadsheets for an 
accurate accounting of the Hurricane Katrina recovery efforts. 



1 The General Services Administration (GSA) is the system steward for FPDS-NG. 

2 The OCPO developed spreadsheets, Katrina United States Government (USG) Direct Presidential Report, 
were provided to the Hurricane Contracting Information Center (HCIC), the public, the Under Secretary for 
Management, DHS-Office of Inspector General (OIG), and the Homeland Security Operations Center 
(HSOC). The HSOC used these spreadsheets to develop briefing documents that were provided to the DHS 
Secretary and the White House. 
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We also identified weaknesses in internal controls related to 
information security as well as capital planning and investment 
control requirements. Specifically, DHS has not established the 
required interconnection security agreements for the connections 
between contract-writing systems and the Homeland Security 
Contract Information System (HSCIS). By not establishing 
interconnection security agreements, the OCPO is increasing the 
risk to the confidentiality, integrity, and availability of agency 
procurement data. Additionally, the DHS OCPO is issuing 
guidance and strategic plans that establish a specific 
contract-writing system as the enterprise-wide solution without 
having performed the required benefit-cost analysis. Without a 
benefit-cost analysis, DHS risks spending money on projects that 
have a projected return on the investment that is not equal to or 
better than alternative uses of available public resources. 

Background 

The Chief Procurement Officer (CPO) is responsible for the 
collection of accurate, timely, and complete acquisition and 
financial assistance data. 4 Additionally, DHS assigned to the CPO 
the responsibility for ensuring that DHS procurement data is 
reported timely and accurately to FPDS-NG. The CPO also has the 
shared responsibility and accountability for designing optimum 
Department-wide integrated systems to continuously improve 
mission support. Further, the CPO is responsible for developing an 
integrated procurement system based on human resources, 
enhanced business processes, and automation across the 
Department. 

Hurricane Katrina struck the Gulf Coast in late August 2005 as an 
extraordinarily powerful and deadly hurricane that carved a wide 
swath of catastrophic damage and inflicted a large loss of life. 
Hurricane Katrina was the costliest, and one of the five deadliest, 
hurricanes to ever strike the United States. Since September 2005, 
the OCPO has collected and reported on contracts awarded to 
assist with the Hurricane Katrina recovery efforts. DHS senior staff 
and other stakeholders requested data on contracts that had been 
awarded to expedite the Hurricane Katrina recovery efforts. The 
OCPO collected procurement data and produced weekly reports to 
satisfy these requests. We reviewed these weekly reports on 



3 The Department of Health and Human Services (HHS) operates the HSCIS. 

4 Delegation Number 0700, Delegation To The Chief Procurement Officer For Acquisition And Financial 
Assistance Management 

DHS' Management of Automated Procurement Systems Needs Improvement 

Page 2 



Hurricane Katrina-related contracts to assess the accuracy of the 
data in DHS' procurement systems. 

Results of Audit 

DHS Needs an Effective IT System to Monitor Procurements 
Department-wide 

DHS senior staff need accurate and timely procurement data in 
order to provide oversight of the billions of dollars spent on the 
Hurricane Katrina recovery efforts. However, DHS does not have a 
comprehensive IT system that provides reliable real-time reporting 
of Hurricane Katrina-related procurements. In response to requests 
from DHS senior staff, the OCPO developed ad hoc electronic 
spreadsheets to provide the most current information on 
procurements related to the Hurricane Katrina recovery efforts. 
However, we identified errors in these spreadsheets that suggest 
that the procurement data reported was not reliable. As a result, the 
OCPO could not ensure the validity of Katrina-related procurement 
data in its report to DHS senior staff and the public. 

FPDS-NG Participation Efforts 

DHS does not have a comprehensive IT system for procurement 
because it has not completed its FPDS-NG participation efforts. 
These participation efforts are to include (1) the direct connection 
of DHS contract writing systems to FPDS-NG and (2) the enabling 
of real-time information gathering and access by FPDS-NG. 
However, not all DHS components have a direct connection to 
FPDS-NG and the OCPO has not taken sufficient steps to ensure 
that data is entered accurately and timely into FPDS-NG. 
Therefore, FPDS-NG could not be used for real-time reporting of 
DHS procurement actions. 

Government agencies are required to have contract- writing 
systems that are capable of electronic transfer of procurement data 
directly to FPDS-NG. However, only two DHS procurement 
offices had contract- writing systems that were transferring data 
directly to FPDS-NG. 5 Other DHS contract-writing systems were 
not directly connected to FPDS-NG because DHS had mandated 
the use of HSCIS as a feeder system to FPDS-NG. 6 Further, the 



5 The United States Coast Guard and the Federal Air Marshal Service 

6 In August 2003, the DHS CPO mandated the use of HSCIS as a transitional step towards standardized 
reporting procedures and in preparation for directly reporting procurement information to FPDS-NG 
beginning in Fiscal Year (FY) 2005. 
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Federal Law Enforcement Training Center, the Transportation 
Security Administration, and Customs and Border Protection have 
not directly connected their contract- writing systems to either 
HSCIS or FPDS-NG. Contracting staff for these three components 
are required to manually enter contract information into HSCIS. 
This additional step may cause delays in reporting of procurement 
data to FPDS-NG. 



The DHS plan to transfer data directly to FPDS-NG included the 
implementation of a single, agency-wide contract- writing system 
that would be directly connected to FPDS-NG. The 
implementation of an agency-wide contract- writing system was a 
part of the DHS Electronically Managing Resources for 
Government Efficiency and Effectiveness (eMerge 2 ) project. 
eMerge 2 is DHS' effort to integrate over 100 systems used to 
support a variety of administrative activities such as accounting, 
acquisition, budgeting, and procurement. However, the efforts of 
the eMerge 2 prime contractor were canceled in January 2006 and 
an enterprise- wide contract writing system has not yet been 
implemented. 

Additionally, the CPO had not taken all available actions to ensure 
that DHS data was entered into FPDS-NG in a timely fashion. For 
example, the CPO had not established performance measures to 
ensure that procurement actions are entered into FPDS-NG in a 
timely fashion. 7 Further, the OCPO also has not updated the 
Homeland Security Acquisition Manual (HSAM) to require that 
(1) contracts to be entered into the collection system within 3 days 
of contract award and (2) contract-writing systems to be connected 
directly to FPDS-NG. 8 

Reporting of Hurricane Katrina Related Procurements 

The OCPO developed ad hoc spreadsheets on Katrina-related 
contracts in response to DHS management requests, and because 
the FPDS-NG could not be relied upon for up-to-date information 
on DHS procurements. These spreadsheets were based on 
procurement information that DHS components provided on a 
weekly basis from their separate paper-based and contract- writing 
systems. The OCPO instituted a process to consolidate this 
procurement data into a series of spreadsheets that they forwarded 
to various stakeholders in a weekly email titled Katrina USG 



7 Management Directive 0003, Acquisition Line of Business Integration and Management, provides the 
CPO with the authority to establish performance metrics in the acquisition area. 

8 FPDS-NG Reporting Manual, Version 1, 2005, Section 1.1.1 requires procurement data to be entered into 
FPDS-NG within 3 days of contract award. 
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Direct Presidential Report. For example, the spreadsheets for the 
week of January 23, 2006 showed a total of $9,294 billion in 
Hurricane Katrina-related contracts that had been awarded by the 
Federal government since August 2005. DHS awarded $4,919 
billion (53%) of these Hurricane Katrina-related contracts. 

We reviewed the OCPO's efforts to consolidate the procurement 
data from the components into the weekly spreadsheets. Based 
upon our review, we identified errors in these weekly spreadsheets, 
including the inconsistent reporting of data and the double 
counting of some procurement transactions. As a result, the OCPO 
could not ensure the validity of Katrina-related procurement data 
in its report to DHS and the public. 

Reporting of Data in the Spreadsheets Needs to be Consistent 

The OCPO did not consistently report all Katrina-related 
procurements in spreadsheets provided to DHS and the public. 
Specifically, the OCPO did not report all Hurricane Katrina-related 
contracts identified as purchase card transactions. For example, in 
the January 23, 2006 weekly spreadsheet, the OCPO included a 
total of $6,863,019 in purchase card transactions. 9 However, in the 
same weekly report, the OCPO excluded a total of $25,872,504 in 
purchase card transactions. 10 The OCPO did not report all purchase 
card transactions because those developing the spreadsheets lacked 
adequate guidance for reporting transactions, thus leading to 
inconsistent interpretations. 

A reason that the weekly spreadsheets were not consistent is due to 
the lack of standard definitions for the data in these documents. For 
example, identification of small business contractors was not 
always consistent. Specifically we identified approximately 
$521 million in contracts that were listed as being awarded to a 
small business starting in September 2005. However, this 
contractor was reclassified as 'other than small business' in 
January 2006. We also identified numerous examples in the 
weekly spreadsheets where the same contractor had varying names 
or addresses. 



9 This $6,863,019 was the total of $6,578,344 and $284,675 in purchase card transactions from Customs 
and Border Protection and Immigration and Customs Enforcement, respectively. 

10 This $25,872,504 was the total of $20,614,502 and $5,258,002 in purchase card transactions from the 
Federal Emergency Management Agency (FEMA) and the United States Coast Guard, respectively. 
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Double Counting of Procurements in the Spreadsheets 



We identified 241 contracts, totaling $242 million, which were 
counted twice in the January 23, 2006 weekly spreadsheets. 
Specifically, the OCPO double counted contracts awarded by the 
General Services Administration (GSA), acting as Federal 
Emergency Management Agency's (FEMA) contracting officer. 
These contracts had been separately reported to both FEMA and 
FPDS-NG. 

OCPO staff are aware of the types of problems we identified with 
the spreadsheets and have implemented a quality assurance process 
to remediate the errors in the spreadsheets. According to OCPO 
officials, this remediation process identified additional duplicate 
entries in the weekly reports. For example: 

• FEMA had reduced the dollar amount of its Katrina-related 
contracts in the weekly reports from $4,048 billion for the 
week of October 28, 2005 to $3. 124 billion for the week of 
November 4, 2005. This reduction included the elimination 
of $777 million in duplicate transactions. 

• In November 2005, the United States Coast Guard also had 
identified duplicates and reduced the dollar amount of its 
procurements from $85 million to $55 million. 

• From January to March 2006, the OCPO has been engaged 
in discussions with GSA to identify and remove data on 
contracts that were counted twice. 

Recommendations 

We recommend that the DHS CPO establish a process to: 

1 . Ensure that procurement information is entered accurately into 
FPDS-NG within three days of contract award so that the 
OCPO can discontinue the use of the ad hoc spreadsheets. 

2. Discontinue the use of HSCIS as a feeder system to FPDS-NG. 

3. Update the HSAM to be consistent with government- wide 
procurement policy guidance. 

Management Comments and OIG Analysis 

DHS concurs with recommendation 1 that information should be 
entered into the FPDS-NG accurately and within a timely manner. 
However, according to DHS, the HSAM 3004.601 requirement for 
data to be entered within 30 days is compatible with the Federal 
Acquisition Regulation (FAR). In their response, DHS cites 

DHS' Management of Automated Procurement Systems Needs Improvement 

Page 6 



FAR 4.601(d), stating that this section of the FAR requires that 
data be transmitted to FPDS in accordance with agency policy. 
While FAR.4.601(d) does not address this topic, FAR 4.601(f) 
requires that "Agencies must transmit this information to the 
Federal Procurement Data System in accordance with its 
procedures," that is, procedures of the FPDS-NG. We disagree 
with DHS' interpretation that the term "its procedures" refers to 
the agencies' procedures. Accordingly, we continue to believe that 
procurement information should be entered into FPDS-NG within 
3 days of contract award. 

DHS concurs with recommendation 2. The OCPO intends to 
discontinue the use of HSCIS in Fiscal Year (FY) 2007. According 
to the OCPO, HSCIS as a system has never been an impediment to 
efficient, timely reporting of DHS procurement actions. Further, 
the OCPO states that HSCIS has provided DHS with reliable data 
extraction and report tools for numerous management reports and 
external information requests when this critical, basic functionality 
was missing in FPDS-NG. OCPO stated that recent enhancements 
to FPDS-NG are now providing this capability and OCPO's intent 
is to discontinue using HSCIS effective October 1, 2006. 

DHS did not agree with recommendation 3. While the OCPO 
stated that the HSAM 3004.601 is compatible with the 
FAR 4.601(d), this section of the FAR does not address this topic. 
Additionally, DHS noted that our report cites a draft version of the 
FPDS-NG Reporting Manual (Version 1, 2005) as the source for 
the 3-day data entry requirement. However, the OCPO also stated 
that the HSAM would be updated to reflect a 3-day entry 
requirement when the draft FPDS-NG Manual is officially 
updated. 

Subsequent to our receipt of DHS' management comments on this 
report, the OCPO acknowledged that the FPDS-NG Reporting 
Manual has been officially issued with the requirement that 
procurement actions be entered into FPDS-NG within 3 days of 
contract award. Accordingly, we expect that DHS will take the 
necessary steps to ensure that FPDS-NG can and will be used for 
real-time reporting of DHS procurement actions. 
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Weaknesses In Internal Control Processes For Procurement Related 
Information Technology Systems 

We identified weaknesses in internal controls related to 
information security as well as capital planning and investment 
control requirements that impact procurement oversight. 
Specifically, the OCPO did not complete the required 
interconnection security agreements for system interconnections 
between contract- writing systems and HSCIS. The OCPO also did 
not conduct a benefit-cost analysis when selecting an agency-wide 
contract-writing system. 

Lack of Interconnection Security Agreements 

OCPO did not establish interconnection security agreements prior 
to connecting DHS procurement computer systems to HSCIS. 
Specifically, interconnection security agreements did not exist for 
the connection between HSCIS and contract-writing systems 
operated by the OCPO and FEMA. The interconnection security 
agreements were not established because (1) the OCPO was 
unaware of this security requirement and (2) HSCIS was not in the 
Office of the Chief Information Officer's (OCIO) system inventory 
because it is a Department of Health and Human Services (HHS) 
system. 

An OCIO official told us that the OCPO contract- writing system is 
undergoing the certification and accreditation process, and the 
interconnection security agreements will be established as part of 
that process. Similarly, HHS officials told us that HSCIS was also 
undergoing certification and accreditation, and that the required 
interconnection security agreements would be established. 

Office of Management and Budget (OMB) Circular A- 130, 
Management of Federal Information Resources, states that 
agencies are to obtain written management authorization before 
connecting their IT systems to other systems. Furthermore, DHS 
Sensitive Systems Policy Publication 4300A, Information 
Technology Security Program, and the National Institute of 
Standards and Technology Special Publication 800-47, Security 
Guide for Interconnecting Information Technology Systems, state 
that the interconnection with other networks is to be documented 
with an interconnection security agreement. The written 
authorization should define the rules of behavior and controls that 
must be sustained for the information system interconnection. 
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By not establishing interconnection security agreements, the 
OCPO is increasing the risk to the confidentiality, integrity, and 
availability of agency procurement data. For example, if the 
interconnection is not properly designed, security failures could 
compromise the connected systems and the data that they store, 
process, or transmit. Similarly, if one of the connected information 
systems is compromised, the interconnection could be used as a 
conduit to compromise the other system and its data. The potential 
for compromise is underscored by the fact that, in most cases, the 
participating organizations have little or no control over the 
operation and management of the other party's system. Thus, if 
information system security oversight roles and responsibilities are 
not clearly defined, there is an increased risk to the confidentiality, 
integrity, and availability of DHS procurement data. 

Benefit- Cost Analysis Was Not Performed Prior to Selection of 
a Procurement-Related System 

The OCPO selected an enterprise-wide contract-writing system 
without performing a benefit-cost analysis prior to making the 
selection. 11 By not completing a benefit-cost analysis, the OCPO 
cannot ensure that it has selected the most cost-effective solution 
for its procurement system requirements. 

OCPO officials told us that a benefit-cost analysis was not required 
because several DHS components had independently selected the 
same contract-writing system. However, OMB Circular A- 130 
requires a benefit-cost analysis to be commensurate with the size 
of the procurement. Therefore, a benefit-cost analysis for a 
component level system would not be sufficient for an 
enterprise-wide system such as that proposed for DHS. OCPO 
officials also told us that the contract- writing system was a part of 
the eMerge 2 contract. However, on January 11, 2006 DHS 
cancelled the eMerge 2 contract before the implementation of a 
contract-writing system. Additionally, OCIO officials told us that 
while the eMerge 2 contractor had recommended the contract- 
writing system for eMerge 2 , the proposed solution was not 
selected, and a benefit-cost analysis was not performed. 

OMB Circular A- 130 requires that agencies establish and maintain 
a capital planning and investment control process that links 
mission needs, information, and information technology in an 
effective and efficient manner. The Department' s processes are 



11 We have previously reported on other capital planning and investment control deficiencies at DHS in 
Management of the DHS Wide Area Network Needs Improvement (Report Number OIG-06-20, December 
2005), page 11. 
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detailed in the DHS Guide to Information Technology Capital 
Planning and Investment Control, dated May 2003. Both 
OMB Circular A- 130 and the DHS guide require a benefit-cost 
analysis to be performed prior to selection of a solution. 

Recommendations 

We recommend that the DHS CPO, in coordination with the Chief 
Information Officer: 

4. Develop the required interconnection security agreements for 
DHS' contract- writing systems and have them signed by the 
appropriate Designated Approving Authorities. 

5. Develop an appropriate benefit-cost analysis prior to the 
selection of an enterprise-wide contract-writing system. 

Management Comments and OIG Analysis 

OCPO concurred with recommendation 4 and has referred this 
recommendation to the Office of the Chief Information Officer for 
joint consideration. OCPO has also concurred with 
recommendation 5 and stated that the eMerge 2 OMB 300 and 
corresponding business case includes PRISM, and will fully 
address the benefit-cost analysis. 
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Appendix A 

Purpose, Scope, and Methodology 



Purpose, Scope, and Methodology 

Following discussions with the Secretary of DHS, we updated our 
annual performance plan to include a review of information 
technology procurement systems. 12 Following the Hurricane 
Katrina disaster, the objective of this planned audit was modified 
to focus on the procurement related IT systems involved in the 
Katrina recovery effort. 

The objective of this audit was to evaluate the effectiveness of the 
IT systems being used by the OCPO to provide oversight of 
Hurricane Katrina-related procurements. Specifically, we focused 
our efforts on determining whether the OCPO is effectively and 
efficiently: (1) compiling its inventory of Hurricane 
Katrina-related procurements; (2) tracking these procurements; and 
(3) reporting the status of these procurements. 

During our audit fieldwork, the OCPO was compiling spreadsheets 
to report on Katrina-related procurements. We analyzed these 
spreadsheets to determine if they were accurate and complete. We 
also performed fieldwork to determine why DHS could not rely on 
FPDS-NG for these reports. In addition, we reviewed the status of 
the OCPO's plans to fully participate in FPDS-NG. 

During our audit work we also identified weaknesses in two areas 
of internal controls associated with the operation and development 
of IT procurement systems. We expanded our fieldwork in order to 
confirm and document our initial observations. This expanded 
fieldwork included contacts with the OCIO, HHS and GSA. We 
also identified a DHS contract specialist that reported having a 
problem since December 2004 with a contract-writing system. We 
contacted the OCIO, reported the problem, and confirmed that the 
identified resolution was successfully implemented. 

We reviewed DHS policies, procedures, documentation, and prior 
audit reports. We analyzed various procurement reports and 
spreadsheets. We interviewed key government and contractor 
personnel, and reviewed Government- wide rules and regulations 
that were relevant to this audit. Fieldwork was performed at DHS 
facilities in the Washington, DC area. 



Department of Homeland Security Office of Inspector General Fiscal Year 2005 Annual Performance 
Plan (Revised May 2005), Chapter 6, Special Performance Initiatives: DHS Procurement Systems 
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We provided the OCPO and FEMA with briefings concerning the 
results of fieldwork, including the identified deficiencies in 
internal controls, as well as the other information summarized in 
this report. We conducted this audit between November 2005 and 
March 2006. 

We performed our work according to generally accepted 
government auditing standards and pursuant to the Inspector 
General Act of 1978, as amended. 

We appreciate the efforts by DHS management and staff to provide 
the information and access necessary to accomplish this audit. The 
Office of Inspector General (OIG) points of contact for this report 
are Frank Deffer, Assistant Inspector General for Information 
Technology (202) 254-4100 and Roger Dressier, Director for 
Information Systems and Architectures (202) 254-5441. Major 
OIG contributors to the audit are identified in Appendix D. 
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Appendix B 

Management's Response to Draft Report 



L.S. Df-paji mirnl of Homeland Nrcurtlv 



JUN 2 2 2006 




M EMORAN DU M FOR: Frank Deffer 

Assistant IrtflpeetorXienera! fef Information Technology 



1 am responding to your memorandum of May 1. 20G6. concerning your Draft Report 
DHS' Management of Automated Procurement Systems heeds Improvement 

My assessment of your draft report is attached to this memorandum. 

Thank you for the opportunity to review and comment on the draft report. I look forward 

to continuing to work with you to build a 21" century acquisition program for the 

Department. 

Please contact Pat Wallis at 202-205-0559 should you have questions or require 
additional information. 

Attachment 

cc: Under Sectary tor Management 




Chief Procurement OfficeT 



SUBJECT: 



Response to the Assessment of DHS' Management of 
Automated Procurement Systems (Dtatl Report A-IT-05- 
012) 
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OCPO Response to DHS OIG Draft Report ATT-0S-0I2 

BACKGROUND 

Shortly after Hurricane Katrina struck the Gulf Coast, Greg Rothwell, 
DHS Chief Procurement Officer (CPO) received a request from Janet Hale, 
Under Secretary for Management (USM) for a White House report. The 
information initially requested was a list of contracts in excess of $1 
million issued in support of the Katrina efforts. The report contained: 
contractor name; description of commodity or service purchased; dollar 
amount; type of contact; and whether the contract was competitive or 
non-competitive. Aa each Hurricane Katrina status brief was provided to 
the Secretary, additional guidance was provided for the information 
requested- The original purpose of the information was to monitor 
contracting activity to small and local businesses as well as to provide 
transparency to the public on Hurricane Katrina contracting recovery 
efforts, DHS management required real-time reporting of the 
procurement data to the White House; due to the devastation in the 
region, this ad-hoc reporting process was established. The official 
accounting records reside in FPDS-NG. 



DHS Lacks an Effective IT System to Monitor Procurements 
Department-wide 

Management Commen ts 

Recommendation 

(1) Ensure that procurement information is entered accurately into 
FPDS-NG within three days of contract award so that the OCPO can 
discontinue the use of ad hoc spreadsheets. 

Rjesjpon«£! DHS concurs that information should be entered into the 
FPDS-NG accurately and within a timely manner. However, the HSAM 
3004.601 currently prescribes that the data will be entered within 30 
days. This is compatible with FAR 4.601(d) which requires that data be 
transmitted to FPDS in accordance with agency policy. 



|2} Discontinue the tise of HSCIS as a feeder system to FPDS-NG. 

Resp onse ; Concur. OCPO intends to discontinue the use of HSCIS in 
FY20O7. HSCIS as a system has never been an impediment to efficient, 
timely reporting of DHS procurement actions. It has provided DHS 
OCPO with reliable data extraction and report tools for numerous 

l 
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management reports and external information requests. This critical, 
basic functionality was missing in FPDS-NG. However, recent 
enhancements to FPDS-NG are now providing this capability. OCFO's 
intent is to discontinue using HSCiS effective October 1, 2006. 

(3) Update the HSAM to be consistent with government-wide 
procurement policy guidance. 

Res ponse ; Non-concur. The HSAM 3004.601 currently prescribes that 
the data will be entered within 30 days. This is compatible with FAR 
4.601(d) which requires that data be transmitted to FPDS in accordance 
with agency policy. The IG report cites the draft FPDS-NG Reporting 
Manual. Version i , 2005 as the source for the 3-day entry requirement, 
The HSAM will be updated to reflect a 3 -day entry requirement when the 
draft FPDS-NG Manual is officially updated. 



Weaknesses in Internal Control Processes tat Procurement Related 
Information Technology Systems 

Management Comments 

Recommendation 

Now recommendation #4: |1) Develop required interconnection security agreements for DHS' 

contract-writing systems and have them signed by the appropriate 
Designated Approving Authorities, 

Response: This recommendation has been referred to the Office of the 
Chief Information Officer for joint consideration. 

Now recommendation #5: |2) Develop an appropriate benefit-cost analysis prior to the 

selection of an enterprisewide contract^ riling system. 

Response : The eMerge 3 OMB 300 and corresponding business case 
includes PRISM, and will fully address die cost-benefit analysis. 



DHS' Management of Automated Procurement Systems Needs Improvement 

Page 15 



Appendix C 

Procurement Reporting Requirements 



The Federal Acquisition Regulation, Volume 1, Section 4.602 
states that FPDS-NG will be used as the basis for recurring and 
special reports to the President, the Congress, the Government 
Accountability Office (GAO), Federal executive agencies and the 
general public. FPDS-NG became operational October 1, 2003. 

OCPO, through Acquisition Alert 03/02A, required all DHS 
components to connect their contract-writing systems to HSCIS, 

13 

which also became available October 1, 2003. Acquisition 
Alert 03/02A further stated that the deployment of HSCIS was a 
transitional step to prepare DHS components for direct reporting of 
procurement information to FPDS-NG beginning in FY 2005. 
While Acquisition Alert 03/02A was only effective until 
September 30, 2004, the requirement to use HSCIS as a feeder 
system to FPDS-NG is still included in HSAM Section 3004.602. 

In December 2003, GAO expressed concerns about the accuracy of 
procurement data in FPDS-NG. 1 This report also stated that: 

"Reliable information is critical to informed decision making 
and to oversight of the procurement system. FPDS has been the 
federal government' s central database of information on 
federal procurement actions since 1978. Congress and 
executive branch agencies rely on FPDS to assess the impact 
that governmentwide acquisition policies and processes are 
having on the system generally, as well as with respect to 
specific geographical areas, markets, and socio-economic 
goals." 

In August 2004, OMB requested that Government agencies 
(1) designate a person responsible for ensuring full participation in 
FPDS-NG and (2) develop plans and schedules to ensure the 
timely and accurate reporting of procurement data to FPDS-NG. 15 
In response, DHS designated the CPO to be responsible for full 
participation in FPDS-NG. DHS also provided a plan that included 
the implementation of a single, agency-wide, contract-writing 
system capable of electronic transfer of all procurement 
information in real-time to FPDS-NG by the end of FY 2005. 



Acquisition Alert - Number 03/02A: Homeland Security Contract Information System (HSCIS) and 
Federal Procurement Data System-Next Generation (FPDS-NG), states that DHS components are to report 
contract/procurement actions, with the exception of purchase card transactions, via HSCIS until such time 
as DHS makes a determination for the agency and any of its organizational elements to report to FPDS-NG 
directly. 

14 GAO-04-295R, Reliability of Federal Procurement Data, December 30, 2003 

15 OMB Memorandum: Timely and Accurate Procurement Data, August 25, 2004 
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Procurement Reporting Requirements 



However, HSCIS and FPDS-NG collection systems were not able 
to provide timely information on procurements. Therefore the 
OCPO requested that DHS components provide weekly 
spreadsheets that documented their Katrina-related procurements. 
The Office of Small and Disadvantaged Business Utilization 
(OSDBU) also provided a chart that shows sub-contracting 
information related to only four large contractors. 16 

The procurement data provided by the DHS components is then 
consolidated by the OCPO and FEMA into a weekly report that 
contains (1) a spreadsheet with detailed information about FEMA 
contracts awarded, (2) a spreadsheet summarizing all DHS awards 
(including FEMA), and (3) the sub-contracting information 
provided by OSDBU. The DHS spreadsheets and the OSDBU 
chart are then forwarded to the Hurricane Contracting Information 
Center (HCIC). In addition, the OCPO publishes the FEMA 
spreadsheet on a publicly accessible website. 17 

The HCIC adds the DHS information into a spreadsheet 
summarizing the Government- wide Katrina-related procurements. 
This new spreadsheet is then provided to the DHS OCPO. The 
OCPO then provides the Government- wide, DHS-wide, and the 
FEMA spreadsheets, along with the OSDBU chart, as the weekly 
Katrina USG Direct Presidential Report to the Under Secretary for 
Management, DHS OIG auditors, and the Homeland Security 
Operations Center (HSOC). The HSOC includes this weekly report 
in briefing documents that are provided to the Secretary of DHS 
and the President. 



Bechtel, CH2M Hill, Fluor Enterprises, and Shaw Group 
http://www.dhs.gov/interweb/assetlibrary/CPO-KatrinaContracts.pdf. 
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Roger Dressier, Director 
Kevin Burke, Audit Manager 
Beverly Dale, Senior Auditor 
Domingo Alvarez, Auditor 
Matthew Worner, Program Analyst 
Steve Ressler, Referencer 
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Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Assistant Secretary, Policy 

Under Secretary, Management 

Assistant Secretary, Public Affairs 

Assistant Secretary, Legislative and Intergovernmental Affairs 

Chief Procurement Officer 

DHS GAO OIG Audit Liaison 

Chief Procurement Officer, Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 
DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 
appropriate 
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Additional Information and Copies 

To obtain additional copies of this report call the Office of Inspector General 
(OIG) at (202) 254-4100; fax your request to (202) 254-4285; or, visit the 
OIG web site at www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind 
of criminal or noncriminal misconduct relative to department programs or 
operations, call the OIG Hotline at 1-800-323-8603; write to DHS Office of 
Inspector General/MAIL STOP 2600, Attention: Office of Investigations - 
Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528; fax 
the complaint to (202) 254-4292; or, email DHSOIGHOTLINE@dhs.gov. The 
OIG seeks to protect the identity of each writer and caller. 



